telnet command: test ports, talk SMTP and HTTP, and exit

Short answer: telnet HOST PORT opens a plain TCP connection to any port and lets you type into it: a quick way to check that a port answers and to talk SMTP or HTTP by hand. It sends everything unencrypted, so never log in to a server with it; use SSH. To quit, press Ctrl+] and type quit.

telnet 203.0.113.10 25      # does port 25 answer?
telnet 203.0.113.10 80      # then type an HTTP request by hand
# stuck in the session? press Ctrl+] and type quit

The commands and messages below follow the telnet man page (the GNU inetutils client that Debian 12 installs) and Microsoft’s telnet reference for Windows.

telnet commands: cheat sheet

What is telnet, and which port does it use?

Telnet is one of the oldest internet protocols (RFC 854, 1983): a text terminal over TCP port 23. It was how people logged in to remote machines before SSH, and it sends every keystroke, passwords included, as plain text. The protocol is dead for logins; the client lives on because it is the simplest way to open a connection to any TCP port and see what answers. When you name a port other than 23, the client does not start telnet option negotiation itself (the man page says so), so it behaves like a raw text connection, good enough for line-based protocols such as SMTP, POP3, IMAP and HTTP/1.1.

Installing the telnet client

Many systems no longer ship it. bash: telnet: command not found on Linux, or 'telnet' is not recognized as an internal or external command, operable program or batch file. on Windows, just means the client is not installed.

sudo apt install telnet

sudo dnf install telnet

On Debian 12 the telnet package is a transitional package that pulls in inetutils-telnet, the GNU client. macOS dropped telnet in High Sierra (10.13); brew install telnet brings it back, or use nc, which macOS still includes (see alternatives).

dism /online /Enable-Feature /FeatureName:TelnetClient

# Windows 10 and 11
Enable-WindowsOptionalFeature -Online -FeatureName TelnetClient

# Windows Server
Install-WindowsFeature -Name Telnet-Client

The same switch is in Control Panel under Programs, then Turn Windows features on or off, Telnet Client. Open a new terminal window afterwards so the new command is found.

Test whether a port is open with telnet

Run it from the machine that needs to reach the port, not from the server itself, since the question is whether the path between the two is open:

$ telnet 203.0.113.10 22
Trying 203.0.113.10...
Connected to 203.0.113.10.
Escape character is '^]'.
SSH-2.0-OpenSSH_9.2p1 Debian-2+deb12u7

Connected to is the answer: the TCP handshake worked. Many services greet you straight away (SSH with its version, SMTP with 220, FTP with 220). HTTP and TLS ports say nothing and wait for you to speak first, so an empty screen after Connected still means open.

A timeout takes a while: Linux gives up on a connection attempt after six retries of the opening packet, about two minutes (/proc/sys/net/ipv4/tcp_syn_retries is 6 on Debian 12). Press Ctrl+C while it still says Trying (and quit if the telnet> prompt appears); you do not have to wait. If a port answers on the server itself but not from outside, checking open ports on Linux walks through listen addresses and firewalls.

No telnet at hand? The open port checker runs the same TCP test from our server in Amsterdam and answers Open, Closed or No answer.

How to exit telnet

Once connected, everything you type goes to the remote service, including Ctrl+C, which is why people get stuck. The way out is the escape character, Ctrl+], which telnet prints when it connects. It opens telnet’s own prompt, where quit ends the program:

^]
telnet> quit
Connection closed.

Microsoft Telnet> quit

• No ] key, or it needs AltGr? On German and other European layouts Ctrl+] often does nothing. Most Linux terminal emulators send the same code for Ctrl+5. Or start telnet with another escape character: telnet -e % 203.0.113.10 25, then % opens the prompt.
• Let the server hang up. QUIT in SMTP, POP3 or FTP, or Connection: close in HTTP, makes the server close the connection, and telnet exits with Connection closed by foreign host.
• Last resort: close the terminal window, or pkill telnet from a second terminal.

Commands at the telnet prompt

Start telnet without a host and you land at the prompt directly; Ctrl+] takes you there from a session. The commands most people need, on both systems:

Two Linux extras are handy: z suspends telnet to your shell (bring it back with fg), and ! command runs one shell command without leaving. On Windows, type commands at the prompt before connecting when they change how the session behaves: set localecho, then o mail.example.com 25. Without local echo, an SMTP server never shows you what you typed, because SMTP servers do not echo.

Talk to a mail server: SMTP on port 25 or 587

This is still the most common reason to install telnet: proving that a mail server accepts connections and seeing exactly where a delivery fails. You type the commands in capitals and the message between DATA and the lone dot; every line starting with a number is the server. This session is illustrative, with Postfix’s usual answers:

$ telnet mail.example.com 25
Trying 203.0.113.25...
Connected to mail.example.com.
Escape character is '^]'.
220 mail.example.com ESMTP Postfix (Debian/GNU)
EHLO test.example.net
250-mail.example.com
250-PIPELINING
250-SIZE 10240000
250-VRFY
250-ETRN
250-STARTTLS
250-ENHANCEDSTATUSCODES
250-8BITMIME
250-DSN
250-SMTPUTF8
250 CHUNKING
MAIL FROM:<test@example.net>
250 2.1.0 Ok
RCPT TO:<postmaster@example.com>
250 2.1.5 Ok
DATA
354 End data with <CR><LF>.<CR><LF>
Subject: telnet test

Hello from telnet.
.
250 2.0.0 Ok: queued as 4B7C21A0F3
QUIT
221 2.0.0 Bye
Connection closed by foreign host.

• The 220 greeting proves the port is open and names the software. No greeting after Connected on port 465 means TLS from the first byte: telnet cannot go further there.
• 554 5.7.1 <user@other.example>: Relay access denied means the server does not accept mail for that domain from you. That is the right answer for a recipient on another domain: without a login, a server only takes mail for its own domains.
• 502 5.5.2 Error: command not recognized after a typo: on Windows, Backspace is sent as a character, so retype the whole line instead of correcting it.
• Port 587 answers the same way, but 250-AUTH usually appears only after STARTTLS, and telnet cannot do TLS. Some servers say so directly with 530 5.7.0 Must issue a STARTTLS command first. From there, switch to openssl s_client -starttls smtp, as shown in SMTP ports.

If telnet gmail-smtp-in.l.google.com 25 hangs at Trying from your computer or a fresh server, outbound port 25 is most likely filtered on that network. Home providers and many hosts block it to stop spam, and the SMTP ports guide explains the options. To find which host to test in the first place, the mail server check lists a domain’s MX hosts with their reverse DNS and SPF, DKIM and DMARC records, read from DNS.

Send a raw HTTP request

HTTP/1.1 is plain text on port 80, so you can type a request by hand. The useful trick: connect to the server’s IP and name the site in the Host header. That skips DNS and any CDN in front, and shows what the origin itself answers. End the request with an empty line (press Enter twice):

$ telnet 203.0.113.10 80
Trying 203.0.113.10...
Connected to 203.0.113.10.
Escape character is '^]'.
HEAD / HTTP/1.1
Host: example.com
Connection: close

HTTP/1.1 200 OK
Server: nginx/1.22.1
Date: Wed, 21 Oct 2026 09:14:02 GMT
Content-Type: text/html
Content-Length: 615
Last-Modified: Mon, 05 Oct 2026 12:00:00 GMT
Connection: close
ETag: "6ac39140-267"
Accept-Ranges: bytes

Connection closed by foreign host.

Use GET instead of HEAD to see the body too. Leave out the Host line and an HTTP/1.1 server answers 400 Bad Request. When a site behind Cloudflare shows error 521, this test against the origin IP tells you at once whether the web server answers at all.

Port 443 and other TLS ports

On 443, 465, 993 and 995 the server expects a TLS handshake, not text. telnet connects, then nothing readable happens. Use a client that speaks TLS and type the same request:

openssl s_client -connect 203.0.113.10:443 -servername example.com -crlf -quiet
curl -sI --resolve example.com:443:203.0.113.10 https://example.com

openssl commands explains the s_client output, and curl covers the --resolve trick.

Alternatives when telnet is not installed

curl -V on Debian 12 (curl 7.88.1) lists telnet among its protocols, and the curl man page describes a telnet:// URL as an interactive session that sends what you type and prints what the server sends. Debian 12 gives inetutils-telnet the priority “standard”, so an install with the standard system utilities may already have telnet while minimal images and containers do not. netcat-openbsd is “optional” there, so on Debian nc usually needs sudo apt install netcat-openbsd first.

Why telnet must never be your login

A telnet session is plain text from end to end. Anyone on the path (the Wi-Fi, a compromised router, a capture on the server’s network) reads the username, the password and every command. Open telnet servers on port 23 are also a favourite target of botnets: Mirai spread in 2016 by logging in to devices over telnet with factory passwords. On a server you administer:

• Nothing should listen on port 23. sudo ss -tlnp 'sport = :23' should print only the header line. If a telnet server was installed, remove it: sudo apt purge inetutils-telnetd on Debian 12.
• Log in over SSH on port 22 or the port you chose, with keys. SSH encrypts the session, and its tunnels replace most of what people once used telnet for.
• Locked out of SSH? Use the provider’s console, not telnet. On a VMHeaven VPS that is the browser VNC console in the panel, which works even when networking on the server is down; dedicated servers have a serial console and power control in the panel.

Telnet still has honest uses: old switches and lab gear on an isolated management network, serial console servers, and text games. None of that belongs on a public address.

Frequently asked